• Share
  • Email
  • Embed
  • Like
  • Save
  • Private Content
RSA Advisory Part I
 

RSA Advisory Part I

on

  • 637 views

RSA Security Advisory Part 1

RSA Security Advisory Part 1

Statistics

Views

Total Views
637
Views on SlideShare
637
Embed Views
0

Actions

Likes
0
Downloads
5
Comments
0

0 Embeds 0

No embeds

Accessibility

Categories

Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

    RSA Advisory Part I RSA Advisory Part I Document Transcript

    • RSA SECURCARE ONLINE NOTEDear RSA SecurCare® Online Customer,Summary:As previously reported, a recent attack on RSA’s systems resulted in certain information being extractedrelated to RSA SecurID® authentication products. This note is being provided in order to help customersfurther assess their risk and prioritize their remediation steps as necessary in relation to this event.RSA SecurID technology continues to be a very effective authentication solution. Whoever attacked RSAhas certain information related to the RSA SecurID solution, but not enough to complete a successfulattack without obtaining additional information that is only held by our customers. We have providedbest practices so customers can strengthen the protection of the RSA SecurID information they hold.Based on feedback from customers, we are issuing this follow-up RSA SecurCare note to help customersassess their risk and prioritize their remediation steps. We strongly urge you to initiate these stepsimmediately, if they are not already part of your environment. These remediation steps are those wehave implemented across RSAs and EMCs business, with respect to our RSA SecurID authenticationsystem.Description:Updated content is being provided to help customers further assess their risk and prioritize theirremediation steps in relation to this event. All content is available on the RSA SecurCare website, andlinks to that content are provided in this note. Updated information includes:  A Customer FAQ providing answers to help customers further assess their risk and prioritize their remediation steps, if they are not already part of your environment. The FAQ is part of this document.  Updates to our best practices guides based on customer feedback, including more detailed Log Monitoring Guidelines related to RSA®Authentication Manager 6.x and 7.x implementations.Affected Products:The only affected products are RSA SecurID authentication products. 1
    • Overall Recommendations:RSA strongly urges customers to review all documents referenced in this note. Based on customerrequests for prioritization of remediation, below are the most important remediation steps beingrecommended to customers:  Secure your Authentication Manager database and ensure strong policy and security regarding any exported data (see Best Practices Guides for specific instructions)  Review recent Authentication Manager logs for unusually high rates of failed authentications and/or next token code events, both of which could indicate suspicious activity (see Authentication Manager 6.x and 7.x Log Guidelines and Best Practices Guides for specific instructions)  Educate your help desk and end users on best practices for avoiding social engineering attacks such as targeted phishing (see Best Practices Guides for specific instructions)  Establish strong PIN and lockout policies for all users (see Best Practices Guides for specific instructions)Please follow the links below to the Security Best Practices Guides.For the latest and most current information on RSA’s recommendations, please join one of RSA’songoing series of customer conference calls. Click here for more information. Even if you have been ona previous call, we encourage you to join future calls for updated information.If you are unable to access the files via RSA SecurCare Online, please contact support at: U.S.: 1-800-782-4362, Option #5 for RSA, Option #1 for RSA SecurCare note Canada: 1-800-543-4782, Option #5 for RSA, Option #1 for RSA SecurCare note International: +1-508-497-7901, Option #5 for RSA, Option #1 for RSA SecurCare noteFor additional global contact numbers please reference: http://www.emc.com/collateral/contact-us/h4165-csc-phonelist-ho.pdf 2
    • CUSTOMER FAQIncident Overview1. What happened?Recently, our security systems identified an extremely sophisticated cyber attack in progress, targetingour RSA business unit. We took a variety of aggressive measures against the threat to protect ourcustomers and our business including further hardening our IT infrastructure and working closely withappropriate authorities.2. What information was lost?Our investigation to date has revealed that the attack resulted in certain information being extractedfrom RSA’s systems. Some of that information is related to RSA SecurID authentication products.3. Why can’t you provide more details about the information that was extracted related to RSA SecurID technology?Our customers’ security is our number one priority. We continue to provide our customers with all theinformation they need to assess their risk and ensure they are protected. Providing additional specificinformation about the nature of the attack on RSA or about certain elements of RSA SecurID designcould enable others to try to compromise our customers’ RSA SecurID implementations.4. Does this event weaken my RSA SecurID solution against attacks?RSA SecurID technology continues to be an effective authentication solution. To the best of ourknowledge, whoever attacked RSA has certain information related to the RSA SecurID solution, but notenough to complete a successful attack without obtaining additional information that is only held by ourcustomers. We have provided best practices so customers can strengthen the protection of the RSASecurID information they hold. RSA SecurID technology is as effective as it was before against otherattacks.5. What constitutes a direct attack on an RSA SecurID customer?To compromise any RSA SecurID deployment, an attacker needs to possess multiple pieces ofinformation about the token, the customer, the individual users and their PINs. Some of thisinformation is never held by RSA and is controlled only by the customer. In order to mount a successfuldirect attack, someone would need to have possession of all this information.6. What constitutes a broader attack on an RSA SecurID customer?To compromise any RSA SecurID deployment, the attacker needs to possess multiple pieces ofinformation about the token, the customer, the individual users and their PINs. Some of this 3
    • information is never held by RSA and is controlled only by the customer. In order to mount a successfuldirect attack, someone would need to have possession of all this information.The broader attack we referenced most likely would be an indirect attack on a customer that uses acombination of technical and social engineering techniques to attempt to compromise all pieces ofinformation about the token, the customer, the individual users and their PINs. Social engineeringattacks typically target customers’ end users and help desks. Technical attacks typically targetcustomers’ back end servers, networks and end user machines. Our prioritized remediation steps in theRSA SecurID Best Practices Guides are focused on strengthening your security against these potentialbroader attacks.7. Have my SecurID token records been taken?For the security of our customers, we are not releasing any additional information about what wastaken. It is more important to understand all the critical components of the RSA SecurID solution.To compromise any RSA SecurID deployment, the attacker needs to possess multiple pieces ofinformation about the token, the customer, the individual users and their PINs. Some of thisinformation is never held by RSA and is controlled only by the customer. In order to mount a successfulattack, someone would need to have possession of all this information.8. Has RSA stopped manufacturing and/or distributing RSA SecurID tokens or other products?As part of our standard operating procedures, while we further harden our environment someoperations are interrupted. We expect to resume distribution soon and will share information on thiswhen available.9. Are any other RSA or EMC products affected?We have no evidence that customer security related to other RSA products has been similarly impactedby this attack. We also are confident that no other EMC products were impacted by this attack. It isimportant to note that we do not believe that either customer or employee personally identifiableinformation has been compromised.10. What new information are you disclosing in this note, and why are you issuing it now?We are not disclosing new information related to the incident. Customers have asked us to providemore specific best practices and also help them prioritize the remediation steps. They also asked us toclarify some of the terms we used in the original communication. We are responding to these requests. 4
    • Immediate Guidance for RSA SecurID Customers11. What are the top four steps I should take to protect my system?RSA strongly recommends that each customer review the RSA SecurID Security Best Practices availableon SecurCare Online and take immediate action to address non-conforming areas in your deployment.Specific areas of focus include the following:  Secure your Authentication Manager database and ensure strong policy and security regarding any exported data (For more information see the Protecting Sensitive Data and Protecting the Authentication Manager Environment section in the RSA Authentication Manager Security Best Practices Guide)  Review recent Authentication Manager logs for unusually high rates of failed authentications and/or next token (For more information see the Authentication Manager Log Monitoring Guidelines)  Educate your help desk and end users on best practices for avoiding social engineering attacks such as targeted phishing. (For more information see the Preventing Social Engineering Attacks section in the RSA Authentication Manager Security Best Practices Guide)  Establish strong PIN and lockout policies for all users (For more information, see the PIN Management section in the RSA Authentication Manager Security Best Practices Guide)We have also included three other security best practice guides for customers who are interested intaking additional measures to further secure their RSA SecurID implementations.12. How do I secure my RSA Authentication Manager Database and exported data?To protect the data stored in your Authentication Manager database: a. Do not store any copies of data extracted from Authentication Manager online. You should keep an encrypted secure copy offline. b. Remote access to Authentication Manager hosts should be reviewed and limited. c. Physically control access to your Authentication Manager servers within your datacenter environment. d. Use firewalls to isolate your Authentication Manager network.For more information see the Protecting Sensitive Data and Protecting the Authentication ManagerEnvironment section in the RSA Authentication Manager Security Best Practices Guide13. How can I monitor my deployment for unusual authentication activity?To detect unusual authentication activity, the Authentication Manager logs should be monitored forabnormally high rates of failed authentications and/or “Next Tokencode Required” events. If these 5
    • types of activities are detected, your organization should be prepared to identify the access point beingused and shut them down.The Authentication Manager Log Monitoring Guidelines has detailed descriptions of several additionalevents that your organization should consider monitoring.14. How do I protect users and help desks against Social Engineering attacks such as targeted phishing?Educate your users on a regular basis about how to avoid phishing attacks. Be sure to follow bestpractices and guidelines from sources such as the Anti-Phishing Working Group (APWG) athttp://education.apwg.org/r/en/index.htm .In addition, make sure your end users know the following:  They will never be asked for and should never provide their token serial numbers, tokencodes, PINs, passwords, etc.  Do not enter tokencodes into links that you clicked in an email. Instead, type in the URL of the reputable site to which you want to authenticate.It is also critical that your Help Desk Administrators verify the end user’s identity before performing anyHelp Desk operations on their behalf. Recommended actions include:  Call the end user back on a phone owned by the organization and on a number that is already stored in the system.  Send the user an email to a company email address. If possible, use encrypted mail.  Work with the employee’s manager to verify the user’s identity  Verify the identity in person  Use multiple open-ended questions from employee records (e.g., “Name one person in your group” or, “What is your badge number?”). Avoid yes/no questionsImportant: Be wary of using mobile phones for identity confirmation, even if they are owned by thecompany, as mobile phone numbers are often stored in locations that are vulnerable to tampering orsocial engineering.For more information see the Preventing Social Engineering Attacks section in the RSA AuthenticationManager Security Best Practices Guide.15. How do I strengthen my PIN and Lockout Policy?The most effective method to strengthen RSA SecurID authentication is to establish strong PIN policiesand to reinforce the importance of secure PIN management with your end users.Note: It is important to strike the right balance between security best practices and userconvenience. If system generated alpha numeric 8 digit pins are too complex, find thestrongest pin policy that best suits your user community. 6
    • RSA recommends the following baseline for PIN management:  Configure Authentication Manager to require the use of 8 digit PINs.  Do not use 4-character numeric pins. If you must use a short PIN (e.g. 4 characters), require alphanumeric characters (a-z, A-Z, 0-9) when the token type supports them.  Configure Authentication Manager to randomly generate PINs. Do not allow your users to choose their PINs.  Instruct all users to guard their PINs and to never tell anyone their PINs. Administrators should never ask for or know the user’s PIN.  Configure Authentication Manager to lockout a user after three failed authentication attempts. Require manual intervention to unlock users who repeatedly fail authentication.For more information, see the PIN Management section in the RSA Authentication Manager Security BestPractices Guide 7